Hardcoded credentials

A Use of Hard-coded Credentials vulnerability exists in the NFX250 Series for the vSRX Virtual Network Function VNF instance, which allows an attacker to take control of the vSRX VNF instance if they have the ability to access an administrative service e.g. SSH on the VNF, either locally, or...

CVE-2020-1614

CVE-2020-1614 : A hard-coded credentials vulnerability affects the Juniper Networks NFX250 Series vSRX VNF. It targets the vSRX VNF instance on versions prior to 19.2R1 and occurs when the root password has not been configured, allowing an attacker with access to an administrative service (e.g., ...

CVE-2019-13559

The CVE-2019-13559 issue affects GE Mark VIe Controllers, where hard-coded credentials may allow a root-user access if a device is deployed with default credentials. The ICSA advisory confirms two vulnerabilities: Improper Authorization and Use of Hard-coded Credentials, indicating local access c...

CVE-2019-13559

GE Mark VIe Controller is shipped with pre-configured hard-coded credentials that may allow root-user access to the controller. A limited application of the affected product may ship without setup and configuration instructions immediately available to the end user. The bulk of controllers go int...

Security Bulletin: Authentication Bypass, Arbitrary Directory Deletion, and Command Injection vulnerabilities in IBM Spectrum Protect Plus (CVE-2020-4208, CVE-2020-4214, CVE-2020-4206, CVE-2020-4241, CVE-2020-4242)

Summary IBM Spectrum Protect Plus is vulnerable to authentication bypass, arbitrary directory deletion, and command injection which allows a remote attacker to execute arbitrary code on the system. Vulnerability Details CVEID: CVE-2020-4208 DESCRIPTION: IBM Spectrum Protect Plus contains hard-cod...

IBM Spectrum Protect Plus Authentication Bypass Vulnerability

IBM Spectrum Protect Plus is a suite of data protection platforms from IBM USA. The platform provides organizations with a single point of control and management and supports backup and recovery for virtual, physical and cloud environments of all sizes. A security vulnerability exists in IBM...

CVE-2020-4208

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

CVE-2020-4208

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

Hardcoded credentials

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

CVE-2020-4208

IBM Spectrum Protect Plus 10.1.0 through 10.1.5 contains hard-coded credentials, such as a password or cryptographic key, which it uses for its own inbound authentication, outbound communication to external components, or encryption of internal data. IBM X-Force ID: 174975...

CVE-2020-4208

CVE-2020-4208 affects IBM Spectrum Protect Plus 10.1.0–10.1.5, where hard-coded credentials are used for inbound authentication, outbound communication, or internal data encryption. The root cause is hard-coded credentials in the product, leading to exposure of authentication and potential unauth...

IBM Spectrum Protect Plus serveradmin Authentication Bypass Vulnerability

This vulnerability allows remote attackers to bypass authentication on affected installations of IBM Spectrum Protect Plus. Authentication is not required to exploit this vulnerability. The specific flaw exists within the Administrative Console Framework service. The service uses a hard-coded...

CVE-2020-1764

A hard-coded cryptographic key vulnerability in the default configuration file was found in Kiali, all versions prior to 1.15.1. A remote attacker could abuse this flaw by creating their own JWT signed tokens and bypass Kiali authentication mechanisms, possibly gaining privileges to view and alte...

CVE-2020-1764

CVE-2020-1764 concerns a hard-coded cryptographic key in Kiali’s default config, affecting all versions

Kiali Trust Management Issues Vulnerabilities

Kiali is an open source, visual management tool for the Istio microservices architecture. A trust management issue vulnerability exists in the default configuration file in versions of Kiali prior to 1.15.1. The vulnerability stems from the fact that the file comes with a hard-coded encryption ke...

TP-Link Archer Code Execution Vulnerability

The TP-Link Archer A7 AC1750 is a wireless router from China P&L TP-Link. A security vulnerability exists in the tdpServer service in the TP-Link Archer A7 using firmware version 190726 AC1750, which stems from the program's use of hard-coded encryption keys. An attacker could exploit the...

CVE-2020-10884

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP...

CVE-2020-10884

This vulnerability allows network-adjacent attackers execute arbitrary code on affected installations of TP-Link Archer A7 Firmware Ver: 190726 AC1750 routers. Authentication is not required to exploit this vulnerability. The specific flaw exists within the tdpServer service, which listens on UDP...

CVE-2020-10884

This CVE concerns TP-Link Archer A7 AC1750 routers running firmware 190726. Affected component is the tdpServer daemon, which listens on UDP port 20002; the issue stems from a hard-coded encryption key, enabling network-adjacent attackers to execute arbitrary code with root privileges in vulnerab...

PT-2020-2707 · Istio · Kiali

Name of the Vulnerable Software and Affected Versions: Kiali versions prior to 1.15.1 Description: The issue is related to a hard-coded cryptographic key in the default configuration file of Kiali, which is part of the Istio service mesh. This flaw can be exploited by a remote attacker to create...